Claude Code and Gemini CLI Flaws Let a Single GitHub Issue Reach CI Pipeline Secrets

A GitHub issue opened by an account with no repository access was enough to execute code on the continuous integration runners behind Anthropic's and Google's own coding agent repositories. On OpenAI's Codex, the same style of attack was enough to hijack the next agent run.

The research, presented at Black Hat USA on August 5 by security firm Novee Security, tested each vendor's coding agent in the configuration it ships by default. The work produced two tracked vulnerabilities. Both have since been patched.

Gemini CLI: a maximum-severity flaw in the container launcher

The more severe of the two sits in Gemini CLI. Tracked as CVE-2026-12537 and carrying a maximum CVSS 4 score of 10.0, the flaw is an OS command injection in the tool's container launcher, reachable through a crafted .gemini/.env file. It let an unprivileged attacker run code on the host of a headless CI platform before the sandbox even started. Google has fixed the issue in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22.

Claude Code: a download counter turned into an exfiltration channel

In Claude Code, the vulnerability tracked as CVE-2026-54316 turned Hugging Face's public download counter into a data exfiltration channel, leaking an API key one character at a time. Every Claude Code release from version 0.2.54 up to 2.1.162 was affected. Anthropic has patched the flaw in version 2.1.163 and noted that exploitation required getting untrusted content into a Claude Code session in the first place.

This is not the first time an Anthropic coding tool's default trust settings have drawn scrutiny this year. MENA Cyber Wire covered a related sandbox escape in Claude Cowork, dubbed SharedRoot, which let untrusted content processed by the agent read SSH keys and cloud credentials on the host machine before it was patched.

Codex: no CVE, but a working hijack chain

The third finding, involving OpenAI's Codex, produced neither a CVE nor a dedicated product patch. Novee said the issue stemmed from two Codex passes running inside a single CI job that shared one checkout, allowing the first pass to write instructions that the second pass would then load and follow. OpenAI has since restructured its own workflow to separate the two passes into different jobs, run Codex with reduced privileges, and flag repository instruction files as untrusted input in its guidance to developers.

The common failure: the harness, not the model

Across all three cases, the underlying failure was not in the AI models themselves but in the surrounding code, often called the harness, that decides what the model is allowed to actually execute. In each instance, a value was marked safe at one stage and then acted on with excessive trust at a later stage.

That distinction matters for how enterprises should read this disclosure. It sits alongside a broader pattern MENA Cyber Wire has tracked this year of AI systems accelerating both sides of the vulnerability research cycle: Moonshot AI's Kimi K3 agent surfaced 19 candidate Redis zero-days in 90 minutes using the same class of automated, high-speed discovery that a motivated attacker could point at a coding agent's own harness.

Current exposure and what to do now

Neither the Gemini CLI nor the Claude Code vulnerability appears in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog as of publication, and researchers found no evidence either chain has been used against a real target. Organizations running these tools in CI pipelines are advised to update to the patched versions immediately and to audit any workflow that can be triggered by an outside contributor, such as through GitHub issues or pull requests.

The disclosure adds to a growing body of research this year into how AI coding agents interact with software supply chains. It follows separate reporting on npm packages compromised to plant hooks that fire inside developer tools such as Claude Code and VS Code, and echoes the credential-exposure pattern MENA Cyber Wire flagged in OAuth client ID spoofing against Microsoft Entra ID, underscoring that as AI agents become more deeply embedded in development pipelines, the permissions boundary around them is becoming one of the most closely scrutinized parts of enterprise software security.

Related Intelligence

1. SharedRoot Vulnerability Let AI Agents Escape Claude Cowork's Sandbox to Read Mac SSH Keys and Cloud Credentials
2. Kimi K3 AI Agent Uncovers New Redis Streams Flaw and Chains Known RCE Bugs

OAuth Client ID Spoofing Enables Stealthy Account Enumeration Without a Single Login